Can I run this without making changes to my files?

Yes, using the --check-only flag will generate a compliance report without applying any modifications to your YAML files.

How does it handle outdated actions?

The skill uses WebSearch to identify the latest releases of official GitHub and Docker actions and can automatically update your workflow files to the newest versions.

What security checks does it perform?

It verifies explicit GHA permissions (least privilege), checks for necessary OIDC tokens for image provenance, and ensures secure registry configurations.

Does it support release automation?

Yes, it specifically configures and audits 'release-please' workflows to automate versioning and changelog generation based on conventional commits.

Does this skill support multi-platform builds?

Yes, it checks for and can automatically configure amd64 and arm64 multi-platform builds using Buildx and QEMU.

GitHub Actions Workflow Configurator

Name: GitHub Actions Workflow Configurator
Author: laurigates

bylaurigates

•

Deployment & DevOps

Audits and configures GitHub Actions CI/CD workflows to ensure compliance with modern standards, security best practices, and optimized build patterns.

The configure-workflows skill automates the management of GitHub Actions pipelines by analyzing existing YAML configurations against industry standards. It identifies outdated action versions, missing security permissions, and performance bottlenecks like lack of caching or multi-platform support. Whether you need to set up a new container build process, implement release-please for automated versioning, or audit your current CI/CD suite for best practices, this skill provides actionable reports and automated fixes to keep your development lifecycle secure and efficient.

Key Features

01Smart project detection to suggest and generate missing essential workflows for Node.js, Python, and more

02Automated version updates for common GitHub Actions (checkout, setup-node, docker)

03Compliance auditing for container builds, including multi-platform and caching support

04Security permission verification including explicit job permissions and OIDC id-token settings

0510 GitHub stars

06Release automation setup and auditing using Google's release-please standards

Use Cases

01Updating a legacy project's CI/CD pipeline to use the latest action versions and modern GitHub features

02Standardizing CI/CD patterns across multiple repositories to maintain consistent build, test, and release cycles

03Ensuring all container build workflows follow security best practices like explicit permissions and registry authentication

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add laurigates/claude-plugins configure-workflows

For use in Claude.ai and ChatGPT

Download Skill